Enabled UEFI Secure Boot on UEFI and StandaloneMm firmware
Step 1: Build EDK2 and StandaloneMm with SecureBoot enabled
Follow the steps in EDK2_00_02_04 Evaluate with OpenSBI to build the EDK2 and StandaloneMm with SecureBoot enabled
Step 2: Create Custom Keys for Secure Boot
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Platform Key/" -keyout PK.key -out PK.crt -days 3650 -nodes -sha256
$ openssl x509 -in PK.crt -out PK.cer -outform DER
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Key Exchange Key/" -keyout KEK.key -out KEK.crt -days 3650 -nodes -sha256
$ openssl x509 -in KEK.crt -out KEK.cer -outform DER
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Database/" -keyout DB.key -out DB.crt -days 3650 -nodes -sha256
$ openssl x509 -in DB.crt -out DB.cer -outform DER
$ sbsign --key DB.key --cert DB.crt --output EmptyApplication-Riscv.efi.signed EmptyApplication-Riscv.efi
This will have Invalid PE header magic issue if use the default sbsign in ubuntu 20.04, need rebuild the sbsigntools, refer the Step 3 to solve this issue ! If no Invalid PE header magic issue then just skip Step 3.
Step 3 (Optional): Download and rebuild the latest sbsigntools
$ git clone https://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git
$ cd sbsigntools/
$ vim src/coff/pe.h
Make sure the RISCV64 machine is there
#define IMAGE_FILE_MACHINE_RISCV64 0x5064
$ git clone https://github.com/rustyrussell/ccan.git lib/ccan.git
$ git submodule init
$ git submodule update
$ sudo apt-get install binutils-dev gnu-efi help2man
$ ./autogen.sh
$ ./configure
$ make
$ cd ../
$ ./sbsigntools/src/sbsign --key DB.key --cert DB.crt --output EmptyApplication-Riscv.efi.signed EmptyApplication-Riscv.efi
Step 4: Copy the public key to the fat disk
$ cp EmptyApplication.efi.signed ~/src/fat/
$ cp EmptyApplication.efi~/src/fat/
$ cp *.cer ~/src/fat/
Step 5: Enroll the PK, KEK, DB keys to the EDK2 as the Custom Secure Keys
Execute the run.sh script in EDK2_00_02_04 Evaluate with OpenSBI
Playing with Secure Boot in Tianocore
By default, TianoCore boots up into Setup Mode, meaning the platform is not provisioned with any keys and the user can take control. To take control, go to the EFI menu screens (type exit if you’re at the efi boot prompt) select the “Device Manager” entry, then “Secure Boot Configuration”. Here you will see the status of the Secure Boot flag (“Attempt Secure Boot”) and the platform mode. Setting the platform from “Standard Mode” to “Custom Mode” will allow you to edit the keys. Once the platform is in “Custom Mode”, a “Custom Secure Boot Options” menu will appear and you will be able to manipulate the four sets of key databases from here. The format of all key files for openssl generated keys is DER format (by default openssl generates PEM format). Note that the KEK, db and dbx options will ask you for a GUID as well as a key file. The GUID is the platform’s way of identifying the key. It serves no purpose other than for you to tell which key is which when you delete them (it’s not used at all in signature verification). By default, since GUIDs aren’t really human readable, I just ignore this and the GUID is set to all zeros.
After Enrolling the PK, KEK, and DB to the Secure Boot Keys, the Secure Boot should be enabled
Step 6: Test the signed EFI application
Reboot and Execute the EmptyApplication-Riscv.efi - get Access Denied
Execute the EmptyApplication-Riscv.efi.signed - get SUCCESS
